Slashdot Mirror

Wow, that's bizarre. It's interesting to note that he is not listed as an author on either the 5th or latest editions.

Wow, that's bizarre. It's interesting to note that he is not listed as an author on either the 5th or latest editions.

Sample Chapter:ch03-enumeration(pdf)
(3) Other Hacknotes titles
Disclosure: I am not a paid endorser for hacknotes products.

Sample Chapter:ch03-enumeration(pdf)
(3) Other Hacknotes titles
Disclosure: I am not a paid endorser for hacknotes products.

• Pick an Editor
  My personal favourite is KATE (K Advanced Text Editor). It has PHP highlighting built in (Easier on the eyes), it can have multiple documents open at the same time, and has some advanced features in comparison to WordPad.
• Save it to server directory
  This is located at /var/www/html/
• Pick a browser
  Mandrake comes with several browsers (Start->Networking->WWW) but my personal favourite is Phoenix.
• Test it in the browser Say you saved you PHP script to
  /var/www/html/myscript.php
  then you would be able to access it by typing in the address
  http://localhost/myscript.php
  This should work fine.
• Configuration
  I found the default configuration fine, but I needed to set up users for mysql. To do this I used Webmin, it should be on your Install CD if it isn't installed already. Once you have Webmin installed, in your browser visit:
  https://localhost:10000/
  Log in using your root (Admin) name and password. Then click servers, then click mysql, and there you go. For a frontend to mysql, i would suggest using PHPMyAdmin
• Learning PHP
  For learning PHP, I would suggest buying a book (I used "PHP A Beginners's Guide", published by osborne see here If you just want to use online resources, I personally think PHP's online manual (Just search The PHP Website. I also find PHP Freaks a good site, with lots of tutorials, examples, free scripts and a friendly forum, if you get stuck
• Hopefully that's enough
  If you need more help, feel free to email me. People will also be happy to help you at MandrakeExpert.com and for specific PHP needs, go to the above mentioned PHP Freaks. Hope I was able to help!

You can keep your symmetruc key on that same machine but you'll have a number of different options as to how to keep that symmetric key safe. One way I've found useful is to use a SALT, as described in the article. A SALT is a very large number which, once blended with a keyphrase produces a Key Encryption Key (KEK) that you can use to encrypt and decrypt your session key. Your keyphrase can be any of a number of things, from a dynamically entered password to another piece of information from the database (say a table name or DOB of a dummy record).

A new SALT is generated every time you want to re-encrypt your session key, helping you prevent precomputations (and therefore brute force attacks/dictionary attacks). The SALT can be stored locally or even on another machine in the clear. It is merely there to add entropy to your KEK. If it is stored on another machine, it could be on a machine segmented away from your network and could be retrieved via a VPN from your database server.

The key of this scheme is that you have dispersed your keys and you can then use machine security, network security, whatever to aid you in helping keep individuals' credit card data secret.

Some Additional Linux Distribution Suggestions

• Caldera Systems
• Turbo Linux
• SuSE
• Mandrake

• Sun/Open Office
• Applix/Applixware Office
• Oracle
• HP
• Compaq
• Dell
• GNU

• Osborne/McGraw-Hill
• O'Reilly
• Sybex

There are certain books that have made their mark among hackers over the years...

Here's another excellent one. It's mainly on the technical aspect, including how-to and countermeasures. I can't recommend it enough. Hacking Exposed. Lots of tools on the website, too.

Spooon!